Cookie banners: what the law actually requires

A visually flawless banner can still be non-compliant if rejecting isn’t as easy as accepting, or if it doesn’t actually block trackers.

The symmetry principle

The EDPB requires the “Reject” button to be as accessible as “Accept”, with no extra click, no hidden submenu, no design that visually nudges toward acceptance (dark patterns). A banner where “Accept” is a big coloured button and “Reject” a discreet small-print link is a frequently flagged non-compliance pattern.

Blocking, not just displaying

Showing a banner isn’t enough: the CMP must block non-essential scripts from running until consent is given, and must actually stop those trackers if the user clicks “Reject”. A banner that displays a choice but leaves scripts running in the background only has the appearance of compliance.

How to check

The only reliable way to verify a banner actually blocks is to simulate a click on “Reject” and measure whether non-essential trackers keep running afterwards. That’s exactly what our scanner does: it doesn’t just detect the presence of a CMP, it tests its actual behaviour.

Does your store follow these rules?

Our free scanner technically checks what fires before consent on your Shopify store, in ~30 seconds.

Scan my store for free

Sources

EDPB — Guidelines 05/2020 on consent